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I— I Abstract 

p ^ A group of n individuals Ai, . . . An who do not trust each other and 

are located far away from each other, want to select a leader. This is 
d the leader election problem, a natural extension of the coin flipping 

Q-( problem to n players. We want a protocol which will guarantee that 

an honest player will have at least ^ — e chance of winning (Ve > 
^ 0), regardless of what the other players do (whether they are honest, 

CN cheating alone or in groups). It is known to be impossible classically. 

This work gives a simple algorithm that does it, based on the weak 
^ coin flipping protocol with arbitrarily small bias recently derived by 

2 Mochon |Moc| . The protocol is quite simple to achieve if the number 

of rounds is linear; We provide an improvement to logarithmic number 
of rounds. 

• ^ 

^ 1 Introduction 



A standard coin flipping is a game in which 2 parties, Alice and Bob, wish 
to flip a coin from a distance. The two parties do not trust each other, and 
would each Uke to win with probability of at least 0.5. A natural problem 
is to find good protocols - a protocol in which a player could not cheat and 
force the outcome of the game to his benefit. 
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There are two types of coin flipping - strong and weak. In strong coin 
flipping, each party might want to bias the outcome to any result. In weak 
coin flipping each party has a favorite outcome. 

We denote the winning probability of an honest Alice in P^, and similarly 
Pb for Bob. The maximum winning probability of a cheating Alice (i.e. 
when she acts according to her optimal strategy, and when Bob is honest) is 
denoted by PJ, and similarly for Bob. 

Let e = max{P\, P^) — ^ be the bias of the protocol. The bias actually tells 
us how good the protocol is. The smaller the bias is, the better the protocol 
is, because the cheating options decrease. 

It is weU known that without computational assumptions, coin flipping 
(whether weak or strong) is impossible to achieve in the classical world. That 
is, one of the players can always win with probability 1. In the quantum 
setting, the problem is far more interesting. 

Quantum strong coin flipping protocols with large but stiU non-trivial bi- 
ases were first discovered. Kitaev then proved (see for example in |ABDR03"] ) 
that in strong coin flipping, every protocol must satisfy P^- P% > \, hence 
e > This result raised the question of whether weak coin flipping 

with arbitrarily small bias is possible. Protocols were found with smaUer 
and smaller biases, untfl Mochon showed in his paper |Moc| that there are 
famihes of weak coin flipping protocols whose bias converges to zero. It is 
also known that even in the quantum world, a perfect protocol (i.e. e = 0) 
is not possible. 

If we try to expand the problem of weak coin flipping to more than 2 
parties - namely Ai,...,An parties with n possible outcomes, where each 
party Ai wins if the outcome is i, we get the leader election problem. 

As mentioned before, it is classically impossible to do a weak coin flipping 
with a bias < 0.5 without assumptions about the computation power. Hence, 
it is also impossible to solve the leader election problem in the classical set- 
ting. |FeiOO| presents a classical leader election protocol (given that a player 
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can flip a coin by herself) that given ^^^^p^ honest players, an honest player 
is chosen with probability Q{5^-^^). In addition there is a proof that every 
classical protocol has a success probability of 0{6^~^)^ for every e > 0. Note 
that there are limitation on the number of cheaters. 

There are many types of Leader elections. The most natural type seems 
to be the one we have just defined, which is n parties wanting to select one 
of them as a leader. We wiU refer to this type as the leader election problem. 
Another possibility is a protocol that chooses a processor randomly among n 
possibilities (there are no cheaters, and we want a protocol that uses minimal 
complexity, or one that works without knowing the number of processors. See 
|TKM07| ). This type sometimes caUed fair leader election problem. 
Until recently there was no quantum result regarding the leader election 
problem as it was defined here. However there were some results on other 
types, such as |ABDR03] which allow penalty for cheaters that got caught 
(which is obviously a weaker version of the problem). 

In |Moc| Mochon showed the existence of a weak coin flipping protocol 
with an arbitrarily small bias of at most e. Let us denote this protocol 
in throughout this paper. This protocol assumes that an honest player 
has I chance of winning. It is also possible to bufld an unbalanced weak 
coin flipping with an arbitrarily small bias e, in which one honest player 
will have q winning probability, and the other player will have 1 — q winning 
probability. We will denote this protocol as Pq^^. In |CK09| it was shown that 
this is possible using repetition of P^. It is very hkely that this can also be 
achieved by finding an appropriate families of time independent point games 
(see |Moc| ). but this will not be done in this paper. 

We wfll present a leader election protocol with n parties (based on Mo- 
chon's result) in which the probability of an honest player to win converges 



to 

n 



Our protocol is fairly simple and uses logn rounds of unbalanced weak 
protocols Pq^^e as wfll be defined later. The protocol uses at most logn 
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unbalanced weak coin flip protocols. This limitation is important, because 
at the moment we only know how to implement an unbalanced flip using a 
repetition of balanced coin flip, which influences our running time complexity. 

2 Leader election protocol 

If n is a power of 2, then the quantum solution is easy (given a good weak 
coin flip protocol) - we can do a tournament (the looser quits) with log{n) 
weak coin flip rounds, and the winner of the tournament wiU be elected as 
the leader. A problem arise when n is not a power of 2, then this is not 
possible, and putting in a dummy involves some difficulties. If the cheaters 
could control the dummy, they would increase their winning probability. 

Our first solution (which was also discovered in |AS09| . independently) 
is to let Ai play A2 and then the winner of that wfll play ^3 and so on, as 
in a tournament, except we use unbalanced weak coin fiips. These are also 
known to be possible using the weak coin flipping protocol (see in |CK09| ) 
but are more expensive in terms of time. 

The leader will be the winner of the final {n — 1) step. This works, however it 
uses many {n — 1) rounds, and thus we later combine the two ideas in order 
to reduce the number of rounds. 

We start by some standard definitions. 

2.1 Definitions and requirements 

By a weak coin flipping protocol we mean that Alice wins if the outcome is 

0, and Bob wins if it is 1. 

A protocol with Pa = q, Pb = ^ — q, bias e wiU be denoted by Pq^e- 

A leader election protocol with n parties Ai, . . . ,An has an outcome t e 

{1, . . . , n}. We win denote by Pj the probabflity that the outcome is t = i. 
We assume that each player has its own private space, untouchable by 

other players, a message space M which is common to aU {M can include a 



4 



space for the idification of the sender and receiver). 

We use the existence of a weak coin flipping protocol with bias at most 
e for every e > . This fact was proved in |Moc| for Pa = Pb = \ and we 
wfll denote it as P^ and by the number of its rounds. It seems possible to 
generalize it to any Pa, Pb, but that was not proved yet. There is a proof 
that there is such a protocol for every Pa-, Pb in |CK09| by repetitions of P^, 
with k ■ rounds. 

Proposition 1. lCK09^ q e [0,1], A; G N ^Px,eo with k ■ rounds, such 
that I a; — g |< and eo < 2e. 

This means that if we want a protocol -Pg,^', we can use the proposition 
with e = g, = |, hence k = l + '~log(^)^. This wfll lead to Px,eo where 
\ X — q \< ^0 < f , and it uses (1 + log(^)) ■ A^^ = 0{\ ■ lege |) rounds. 

Corollary 2. Forq ^ \ the protocol Pg^^ will use no more thanO{\ A^i-loge |) 
rounds. 

There is one delicate point, that the cheaters can not increase their win- 
ning probabflity in a specific protocol, by loosing previous protocols (say by 
creating entanglements). This wfll be discussed in the end. 

We wfll first present the simpler case of 3 parties, to show the basic idea. 
The general case is a natural generalization of this, and we will analyze it 
in details. Nevertheless this case captures the basic idea of the problem and 
solution. 



2.2 Three parties: A,B,C 

Ahce, Bob and Charlie want to select a leader. Alice wfll be elected if the 
outcome will be 0, Bob if it will be 1 and Charlie will win on outcome 2. 

Let e > 0. We wifl show a leader election protocol, such that if all are 
honest then Pq = -Pi = -P2 = |- 

If party i is honest then we want that Pj > | — e. 

Let e' = I be a constant depend on e. 
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2.2.1 Protocol 

1. Alice plays Bob -Pi,^'- 

2. The winner plays Charlie -P|,e'- 

3. The winner of that flip is declared as the leader. 




1/2 1/2 



2.2.2 Analysis 

• If all players are honest, then A (same for B) has | • | = | chance of 
winning. (| the chance of winning B, and | to then win C). 

C has just one game, so he obviously has | chance of winning. 

• If A is honest, we can think of it as if A is the only honest player. Then 
the calculation is almost the same from her point of view: In the first 
game she has | — e' winning probability, and in the second (if she won 
the first) she has | — e' winning probability. So in the total she has 
(| - eO(| - e') = I - |e' + e'2 > I - = I - ^e. Thus wc have extra 
f^e to spare (the coalition B — C has less than | + e chance of winning). 

• If S is honest then the calculation is the same, just replace A with B 
and vice versa. 

• If C is honest - again he has only one flip, so he has at least | — e' > 
i ~ chance of winning. 
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• Number of coin flips = 2. 

• First coin flip is Pi hence involves N^i rounds. 

Second coin flip is We have > 2 - 1 probabflity to spare. Hence 
by 0, it can be done with less than (1 -log(|)) ■ A^^' < (4 + log ^) ■ A^^' 
rounds. 

2.3 First try for n parties 

In the general case we have n parties Ai, . . . , y4„. 

Let e > 0. We wiU show a leader election protocol, such that if all are 
honest then P, = -. 

If party i is honest then we want that Pi > — e. 

Let e' < ^ be a constant that depends on e (the condition on e' is far 
from tight, for convenient of the calculation). 

2.3.1 Protocol: 

1. Let W = Ai. 

2. For i = 2 to n 

(a) W plays Ai a P.-i ^, weak coin flipping protocol. 

(b) W is the winner. 

3. W is declared as the leader. 
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2.3.2 Analysis 

Note that player j enters the game in the jth stage (i.e. when i = j on in 
the protocol), when he plays coin flip with winning probability Pi = 1 — ^ = 
I (The only exception in the protocol is Ai that also plays for the first time 
when i = 2, but then also Pi =|, so it is the same). 

• If all are honest, then = ^ ■ ^ ■ ■ . . . ■ ^ ■ ^ = I. 

' ' I i+l 1+2 n—1 n n 

• If A is honest. Pi ^ {\ - e') ■ f[{j^^ - e') > ^ - ne' ^ ^ - e (and we 

j=i 

have more than e to spare). 

• Number of coin fiips = n — 1. 

The ith coin flip is P»-i ,, so it wiU have (1 + log(e)) • N^f rounds. 

i ' 

2.4 Improved protocol for seven players 

We mentioned in the beginning that if n = 2"*, we can do a tournament with 
m rounds. In the last try we came up with a protocol of n — 1 rounds, because 
each time only one couple played a coin flip. The problem with this simple 
solution is that it is quite inefficient in terms of number of rounds, and also 
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almost all the coin flips are unbalanced. We can improve this protocol by 
combining it with the tournament idea. 

2.4.1 Protocol 

1. The foUowing couples play P^^e'- ~ ^2, ^3 — ^4, ^5 — ^6- 

2. The winners of Ai — A2, A^ — A4 play between them -Pi,g/- 
The winner of A^ — Aq plays A^ a P2 



3. The two winners of last stage play a P±^e'- 




2.4.2 Analysis 

• If aU are honest, then Ai — A4 have the same steps, and they have 
winning probability of | • | • | = ^. 

A^jAq have a winning probability of | • | • | = |. 
Ay has only two flips, so obviously P7 = | • | = |. 

• If Ai is honest he has winning probability of (| — e')(| — e')(| — e') = 

1 _ 23 ^4 /2 _ /3 > 1 _ 23g' 

Same result for A2 — A^. 
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If A5 (or Aq) is honest then he has winning probabihty of (| — e')(| — 

For A7 it is obviously > ^ — Ife'. 

• Number of coin flips steps = 3. 

• We have more than |e' to spare, hence we can comfortably take e' = ^■ 
2.5 Final protocol 

In the general case we have n parties Ai, .... An. 

Let e > 0. We will show a leader election protocol, such that if all parties 
are honest then Pj = ^, with log(n) coin flipping rounds. 

If party i is honest then we want that Pi > — e. 

Let e' < 2\ogn ^ constant that depends on e (the condition on e' is far 
from tight, for convenient of the calculation). 

2.5.1 Protocol 

We wfll define the protocol recursively. 
Let us caU it Leader {{Ai, . . . , An}, e). 
Say it returns the leader selected. 
Let A; e N s.t. 2^= < n < 2^+^ 

1. The foUowing are done simultaneously: 

• Ai, . . . ,A2k plays a tournament (of k rounds) among themselves 

with Pi /. Denote the winner as Wt. 

2 '*= 

• Leader ({^fc+i, . . . , An}). 

2. wi plays W2 a P2fc ,. 

The winner of this is the leader. 
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2.5.2 Analysis 

• Assume that all parties are honest. 

Look at Ai, . . . , A2k. In the tournament everyone has a ^ winning 
chance. Then they have another coin flip with ^ winning chance, so 
in total they each have ^ " ~ = ~ winning chance. 
From induction we know each of A2fe+i,...,A„ has a winning 
chance in the recursive leader procedure (to become 102). Then the 
winner has a 1 — ^ winning chance in the last step, so altogether he 
has ^ . (1- 2^) = i. 

• We have log(n) coin flipping steps, and according to ([2| we wiH have 
up to 0(1 N^i log(e) log(n) |) total rounds. 

log(n) 

• If Ai is honest, then he has a winning probability of H (^i — e') > 

i=l 

l-\og{n)e' {d < 1). 

• The number of unbalanced coin flips is bounded by log{n). 

In fact: ^unbalanced coin flips = (# of I's in the binary representation 
of n) - 1. 

This can be proved easily by induction on n: 
For n = 2, 3, 4 it is clear. 

If n = 2^ then it has such. Else 2^ < n < 2^^^, and the flrst 2^ use 
again unbalanced coin flips between them. The remaining n — 2^ use 
from the induction hypothesis the of I's in its binary from - 1. When 
joining the two groups, we again use an unbalanced coin flip which is 
equivalent to the MSB 1 in the binary form of the n in the kth bit (From 
the 2*^). 
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3 Remarks 

3.1 Consecutive coin flipping protocols 

Let P be a weak coin flipping protocol, with the maximal cheating prob- 
abflity of Bob. 

We want to run two instances of P, one after the other (not even at the 
same time). 

We wfll define (see |Moc| for full detafls): 

• Let 'H = A^M0Bhe the Hflbert space of the system. 

• I ipo >=\ ipA,o >\ "ipMfi >| i^Bfl > is the initial state of the system. 

• Let there be n (even) stages, i denote the current stage. 

• On the odd stages i, Ahce wfll apply a unitary Ua,! on A® A4. 

• On the even stages. Bob wfll apply a unitary f/^ j on M ^ B. 

• Let I V'j > be the state of the system in the ith stage. 

• Let pA,i = TrM(S)B{\ 'ipi >< ipi \) he the density matrix of Ahce in the 
ith stage. 

• Ahce's initial state (density matrix) is '■^V^.o = I'^a.o >< V'a.oI- 

• For even state i we have ^'^^pA,i = PA,i-i- 

• Let pA,i be the state oi A® M after Alice gets the ith message. 

• For odd i : ^^^pA,i = TrM{pA,i), ^'^^pA.i = TrMiUA,ipA,i~iU\i). 
We know that 

P^ < max Tr[UA,ipA,n] (1) 

p:(l)-(4) 



regardless of Bob's actions (see |Moc| for fufl proof). 
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We conclude that Bob can not improve his winning chances in a specific 
round by doing something in previous rounds. 

Corollary. If Alice plays Bob a series of weak coin flipping Pq^^e,, then Bob's 
winning probability is bounded from above by 1 — qi in the ith game. 

Since Alice will always start the protocol with a new-empty environment 
(i.e. no correlations or leftovers from previous protocols), Bob cannot achieve 
a higher winning probability than the bound at [T] in any way, including 
correlations from previous protocols. (If one could have raised his winning 
probability, by using a previous protocol, he could have also done it without 
using it). 

3.2 The message space 

When we analyze coin fiipping between two players, we assume one of them 
is honest and analyze the scenario that the other player is cheating and we 
then bound his winning probability. In multiparty protocol, such as the 
leader election, another possibility might occur. A cheating player Ai might 
interfere a weak coin flipping protocol between two other players Aj and Ak 
(honest or not). We claim that this should not change our computation. 

Claim. If Aj plays Ak a Pq_e coin flip, then even if Ai interferes, it does not 
change their winning probabilities. 

We can look at it from the point of view of honest Aj. He can assume 
that the rest of the players are cheaters. When he plays against Ak it doesn't 
matter whether Ai interferes (as long as he does not change Aj private space), 
because a cheater A^ could have done the same on its own, and this scenario 
is included in the calculation of P* . Hence leaving the winning probabilities 
unchanged. 
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3.3 Additional work 



A related work was published |AS09| recently. They refer to the leader elec- 
tion problem as weak dice rolhng, and they use the same protocol as we did 
(independently) in 2.3 They also extend the leader election problem to the 
strong scenario, under the name of strong dice rolling. Namely they con- 
sider the problem of M > 2 remote parties, having to decide on a number 
between 1 and > 3, without any party being aware to any other's pref- 
erence. They generalize Kitaev's bound to apply to this case, and get that 

P^^^* ■ . . . ■ P^]* >-^, i G {1, ,M} where P^^,* gives the probability for 

the outcome i when all parties but the jth are dishonest and acting in unison 
to force the outcome i. This was done by noting that strong leader election 
can always be used to implement strong imbalanced coin flipping. They also 
extend the protocol in |CK09| to 2 ■ M parties and A^^ outcomes for any 
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